[richardwhiuk]

Redirect to a page setting a cookie with the token in, which is then scoped to the domain via Site Origin policies.